seamless-cli 0.2.0

package/dist/generators/deploy/aws/dev/template.js

@@ -0,0 +1,1240 @@
+function tf(value) {
+    return value.replace(/"/g, '\\"');
+}
+function escapeTfString(value) {
+    return value
+        .replace(/\\/g, "\\\\")
+        .replace(/"/g, '\\"')
+        .replace(/\n/g, "\\n");
+}
+function renderEnvEntries(vars) {
+    return vars
+        .map((envVar) => `{ name = "${escapeTfString(envVar.name)}", value = "${escapeTfString(envVar.value)}" }`)
+        .join(",\n        ");
+}
+function renderUserEnvVars(vars) {
+    return vars
+        .filter((envVar) => envVar.target === "task_definition")
+        .map((envVar) => ({
+        name: envVar.key,
+        value: envVar.value,
+    }));
+}
+export function renderMainTf() {
+    return `
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.6"
+    }
+  }
+}
+
+provider "aws" {
+  region  = var.aws_region
+  profile = var.aws_profile
+}
+`.trimStart();
+}
+export function renderVariablesTf(manifest) {
+    return `
+variable "project_name" {
+  type    = string
+  default = "${tf(manifest.projectName)}"
+}
+
+variable "aws_region" {
+  type    = string
+  default = "${tf(manifest.region)}"
+}
+
+variable "aws_profile" {
+  type    = string
+  default = "${tf(manifest.awsProfile)}"
+}
+
+variable "root_domain" {
+  type    = string
+  default = "${tf(manifest.domain.root)}"
+}
+
+variable "hosted_zone_domain" {
+  type    = string
+  default = "${tf(manifest.domain.hostedZoneDomain ?? manifest.domain.root)}"
+}
+
+variable "web_host" {
+  type    = string
+  default = "${tf(manifest.domain.webHost)}"
+}
+
+variable "api_host" {
+  type    = string
+  default = "${tf(manifest.domain.apiHost)}"
+}
+
+variable "auth_host" {
+  type    = string
+  default = "${tf(manifest.domain.authHost)}"
+}
+
+variable "admin_host" {
+  type    = string
+  default = "${tf(manifest.domain.adminHost)}"
+}
+
+variable "backup_enabled" {
+  type    = bool
+  default = ${manifest.backup.enabled ? "true" : "false"}
+}
+
+variable "backup_retention_days" {
+  type    = number
+  default = ${manifest.backup.retentionDays}
+}
+
+variable "web_image" {
+  type    = string
+  default = "REPLACE_WEB_IMAGE_URI"
+}
+
+variable "api_image" {
+  type    = string
+  default = "REPLACE_API_IMAGE_URI"
+}
+
+variable "auth_image" {
+  type    = string
+  default = "REPLACE_AUTH_IMAGE_URI"
+}
+
+variable "admin_image" {
+  type    = string
+  default = "REPLACE_ADMIN_IMAGE_URI"
+}
+
+variable "postgres_image" {
+  type    = string
+  default = "REPLACE_POSTGRES_IMAGE_URI"
+}
+
+variable "ecs_instance_type" {
+  type    = string
+  default = "t3.large"
+}
+
+variable "desired_capacity" {
+  type    = number
+  default = 1
+}
+
+variable "api_origin" {
+  type = string
+}
+
+variable "auth_issuer" {
+  type = string
+}
+
+variable "web_origin" {
+  type = string
+}
+
+variable "admin_origin" {
+  type = string
+}
+
+variable "rpid" {
+  type = string
+}
+
+variable "api_service_token" {
+  type      = string
+  sensitive = true
+}
+
+variable "cookie_signing_key" {
+  type      = string
+  sensitive = true
+}
+
+variable "bootstrap_secret" {
+  type      = string
+  sensitive = true
+}
+
+variable "auth_db_user" {
+  type = string
+}
+
+variable "auth_db_password" {
+  type      = string
+  sensitive = true
+}
+
+variable "auth_db_name" {
+  type = string
+}
+
+variable "api_db_user" {
+  type = string
+}
+
+variable "api_db_password" {
+  type      = string
+  sensitive = true
+}
+
+variable "api_db_name" {
+  type = string
+}
+
+variable "jwks_active_kid" {
+  type = string
+}
+
+variable "seamless_jwks_active_kid" {
+  type = string
+}
+
+variable "jwks_private_key" {
+  type      = string
+  sensitive = true
+}
+
+variable "jwks_public_keys" {
+  type      = string
+  sensitive = true
+}
+
+locals {
+  app_slug = replace(lower(var.project_name), " ", "-")
+  common_tags = {
+    Project = var.project_name
+    Tier    = "dev"
+    Managed = "seamless-cli"
+  }
+}
+`.trimStart();
+}
+export function renderNetworkingTf() {
+    return `
+resource "aws_vpc" "main" {
+  cidr_block           = "10.40.0.0/16"
+  enable_dns_hostnames = true
+  enable_dns_support   = true
+
+  tags = merge(local.common_tags, {
+    Name = "\${local.app_slug}-vpc"
+  })
+}
+
+resource "aws_internet_gateway" "main" {
+  vpc_id = aws_vpc.main.id
+
+  tags = merge(local.common_tags, {
+    Name = "\${local.app_slug}-igw"
+  })
+}
+
+resource "aws_subnet" "public_a" {
+  vpc_id                  = aws_vpc.main.id
+  cidr_block              = "10.40.1.0/24"
+  map_public_ip_on_launch = true
+  availability_zone       = "\${var.aws_region}a"
+
+  tags = merge(local.common_tags, {
+    Name = "\${local.app_slug}-public-a"
+  })
+}
+
+resource "aws_subnet" "public_b" {
+  vpc_id                  = aws_vpc.main.id
+  cidr_block              = "10.40.2.0/24"
+  map_public_ip_on_launch = true
+  availability_zone       = "\${var.aws_region}b"
+
+  tags = merge(local.common_tags, {
+    Name = "\${local.app_slug}-public-b"
+  })
+}
+
+resource "aws_route_table" "public" {
+  vpc_id = aws_vpc.main.id
+
+  tags = merge(local.common_tags, {
+    Name = "\${local.app_slug}-public-rt"
+  })
+}
+
+resource "aws_route" "internet_access" {
+  route_table_id         = aws_route_table.public.id
+  destination_cidr_block = "0.0.0.0/0"
+  gateway_id             = aws_internet_gateway.main.id
+}
+
+resource "aws_route_table_association" "public_a" {
+  subnet_id      = aws_subnet.public_a.id
+  route_table_id = aws_route_table.public.id
+}
+
+resource "aws_route_table_association" "public_b" {
+  subnet_id      = aws_subnet.public_b.id
+  route_table_id = aws_route_table.public.id
+}
+`.trimStart();
+}
+export function renderRoute53Tf() {
+    return `
+data "aws_route53_zone" "main" {
+  name         = var.hosted_zone_domain
+  private_zone = false
+}
+
+resource "aws_route53_record" "web" {
+  zone_id = data.aws_route53_zone.main.zone_id
+  name    = var.web_host
+  type    = "A"
+
+  alias {
+    name                   = aws_lb.main.dns_name
+    zone_id                = aws_lb.main.zone_id
+    evaluate_target_health = true
+  }
+}
+
+resource "aws_route53_record" "api" {
+  zone_id = data.aws_route53_zone.main.zone_id
+  name    = var.api_host
+  type    = "A"
+
+  alias {
+    name                   = aws_lb.main.dns_name
+    zone_id                = aws_lb.main.zone_id
+    evaluate_target_health = true
+  }
+}
+
+resource "aws_route53_record" "auth" {
+  zone_id = data.aws_route53_zone.main.zone_id
+  name    = var.auth_host
+  type    = "A"
+
+  alias {
+    name                   = aws_lb.main.dns_name
+    zone_id                = aws_lb.main.zone_id
+    evaluate_target_health = true
+  }
+}
+
+resource "aws_route53_record" "admin" {
+  zone_id = data.aws_route53_zone.main.zone_id
+  name    = var.admin_host
+  type    = "A"
+
+  alias {
+    name                   = aws_lb.main.dns_name
+    zone_id                = aws_lb.main.zone_id
+    evaluate_target_health = true
+  }
+}
+`.trimStart();
+}
+export function renderAcmTf() {
+    return `
+variable "acm_certificate_arn" {
+  type = string
+}
+`.trimStart();
+}
+export function renderAlbTf() {
+    return `
+resource "aws_security_group" "alb" {
+  name        = "\${local.app_slug}-alb-sg"
+  description = "ALB security group"
+  vpc_id      = aws_vpc.main.id
+
+  ingress {
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = local.common_tags
+}
+
+resource "aws_lb" "main" {
+  name               = substr("\${local.app_slug}-alb", 0, 32)
+  internal           = false
+  load_balancer_type = "application"
+  security_groups    = [aws_security_group.alb.id]
+  subnets            = [aws_subnet.public_a.id, aws_subnet.public_b.id]
+
+  tags = local.common_tags
+}
+
+resource "aws_lb_target_group" "web" {
+  name        = substr("\${local.app_slug}-web", 0, 32)
+  port        = 80
+  protocol    = "HTTP"
+  target_type = "instance"
+  vpc_id      = aws_vpc.main.id
+
+  health_check {
+    path = "/"
+  }
+
+  tags = local.common_tags
+}
+
+resource "aws_lb_target_group" "api" {
+  name        = substr("\${local.app_slug}-api", 0, 32)
+  port        = 3000
+  protocol    = "HTTP"
+  target_type = "instance"
+  vpc_id      = aws_vpc.main.id
+
+  health_check {
+    path = "/health"
+  }
+
+  tags = local.common_tags
+}
+
+resource "aws_lb_target_group" "admin" {
+  name        = substr("\${local.app_slug}-admin", 0, 32)
+  port        = 80
+  protocol    = "HTTP"
+  target_type = "instance"
+  vpc_id      = aws_vpc.main.id
+
+  health_check {
+    path = "/"
+  }
+
+  tags = local.common_tags
+}
+
+resource "aws_lb_target_group" "auth" {
+  name        = substr("\${local.app_slug}-auth", 0, 32)
+  port        = 5312
+  protocol    = "HTTP"
+  target_type = "instance"
+  vpc_id      = aws_vpc.main.id
+
+  health_check {
+    path = "/health/status"
+  }
+
+  tags = local.common_tags
+}
+
+resource "aws_lb_listener" "http" {
+  load_balancer_arn = aws_lb.main.arn
+  port              = 80
+  protocol          = "HTTP"
+
+  default_action {
+    type = "redirect"
+
+    redirect {
+      port        = "443"
+      protocol    = "HTTPS"
+      status_code = "HTTP_301"
+    }
+  }
+}
+
+resource "aws_lb_listener" "https" {
+  load_balancer_arn = aws_lb.main.arn
+  port              = 443
+  protocol          = "HTTPS"
+  certificate_arn   = var.acm_certificate_arn
+  ssl_policy        = "ELBSecurityPolicy-2016-08"
+
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.web.arn
+  }
+}
+
+resource "aws_lb_listener_rule" "api" {
+  listener_arn = aws_lb_listener.https.arn
+  priority     = 10
+
+  condition {
+    host_header {
+      values = [var.api_host]
+    }
+  }
+
+  action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.api.arn
+  }
+}
+
+resource "aws_lb_listener_rule" "auth" {
+  listener_arn = aws_lb_listener.https.arn
+  priority     = 20
+
+  condition {
+    host_header {
+      values = [var.auth_host]
+    }
+  }
+
+  action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.auth.arn
+  }
+}
+
+resource "aws_lb_listener_rule" "admin" {
+  listener_arn = aws_lb_listener.https.arn
+  priority     = 30
+
+  condition {
+    host_header {
+      values = [var.admin_host]
+    }
+  }
+
+  action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.admin.arn
+  }
+}
+`.trimStart();
+}
+export function renderLogsTf(manifest) {
+    return `
+resource "aws_cloudwatch_log_group" "web" {
+  name              = "/${tf(manifest.projectName)}/dev/web"
+  retention_in_days = 14
+  tags              = local.common_tags
+}
+
+resource "aws_cloudwatch_log_group" "api" {
+  name              = "/${tf(manifest.projectName)}/dev/api"
+  retention_in_days = 14
+  tags              = local.common_tags
+}
+
+resource "aws_cloudwatch_log_group" "auth" {
+  name              = "/${tf(manifest.projectName)}/dev/auth"
+  retention_in_days = 14
+  tags              = local.common_tags
+}
+
+resource "aws_cloudwatch_log_group" "admin" {
+  name              = "/${tf(manifest.projectName)}/dev/admin"
+  retention_in_days = 14
+  tags              = local.common_tags
+}
+
+resource "aws_cloudwatch_log_group" "postgres" {
+  name              = "/${tf(manifest.projectName)}/dev/postgres"
+  retention_in_days = 14
+  tags              = local.common_tags
+}
+
+resource "aws_cloudwatch_log_group" "backup" {
+  name              = "/${tf(manifest.projectName)}/dev/backup"
+  retention_in_days = 14
+  tags              = local.common_tags
+}
+`.trimStart();
+}
+export function renderS3Tf() {
+    return `
+resource "random_id" "bucket_suffix" {
+  byte_length = 4
+}
+
+resource "aws_s3_bucket" "backups" {
+  bucket = "\${local.app_slug}-db-backups-\${random_id.bucket_suffix.hex}"
+
+  tags = local.common_tags
+}
+
+resource "aws_s3_bucket_versioning" "backups" {
+  bucket = aws_s3_bucket.backups.id
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "backups" {
+  bucket = aws_s3_bucket.backups.id
+
+  rule {
+    id     = "expire-old-backups"
+    status = "Enabled"
+
+    filter {}
+
+    expiration {
+      days = var.backup_retention_days
+    }
+  }
+}
+`.trimStart();
+}
+export function renderIamTf() {
+    return `
+resource "aws_iam_role" "ecs_task_execution" {
+  name = "\${local.app_slug}-ecs-task-execution-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [{
+      Action = "sts:AssumeRole",
+      Effect = "Allow",
+      Principal = {
+        Service = "ecs-tasks.amazonaws.com"
+      }
+    }]
+  })
+
+  tags = local.common_tags
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_task_execution_default" {
+  role       = aws_iam_role.ecs_task_execution.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
+}
+
+resource "aws_iam_role" "ecs_task_role" {
+  name = "\${local.app_slug}-ecs-task-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [{
+      Action = "sts:AssumeRole",
+      Effect = "Allow",
+      Principal = {
+        Service = "ecs-tasks.amazonaws.com"
+      }
+    }]
+  })
+
+  tags = local.common_tags
+}
+
+resource "aws_iam_policy" "backup_s3" {
+  name = "\${local.app_slug}-backup-s3-policy"
+
+  policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect = "Allow",
+        Action = [
+          "s3:PutObject",
+          "s3:ListBucket"
+        ],
+        Resource = [
+          aws_s3_bucket.backups.arn,
+          "\${aws_s3_bucket.backups.arn}/*"
+        ]
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_task_backup_s3" {
+  role       = aws_iam_role.ecs_task_role.name
+  policy_arn = aws_iam_policy.backup_s3.arn
+}
+
+resource "aws_iam_role" "ecs_instance_role" {
+  name = "\${local.app_slug}-ecs-instance-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [{
+      Action = "sts:AssumeRole",
+      Effect = "Allow",
+      Principal = {
+        Service = "ec2.amazonaws.com"
+      }
+    }]
+  })
+
+  tags = local.common_tags
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_instance_ec2_container" {
+  role       = aws_iam_role.ecs_instance_role.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_instance_ssm" {
+  role       = aws_iam_role.ecs_instance_role.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+}
+
+resource "aws_iam_instance_profile" "ecs" {
+  name = "\${local.app_slug}-ecs-instance-profile"
+  role = aws_iam_role.ecs_instance_role.name
+}
+`.trimStart();
+}
+export function renderEc2Tf() {
+    return `
+data "aws_ssm_parameter" "ecs_optimized_ami" {
+  name = "/aws/service/ecs/optimized-ami/amazon-linux-2/recommended/image_id"
+}
+
+resource "aws_security_group" "ecs_host" {
+  name        = "\${local.app_slug}-ecs-host-sg"
+  description = "ECS host security group"
+  vpc_id      = aws_vpc.main.id
+
+  ingress {
+    from_port       = 32768
+    to_port         = 65535
+    protocol        = "tcp"
+    security_groups = [aws_security_group.alb.id]
+  }
+
+  ingress {
+    from_port       = 80
+    to_port         = 80
+    protocol        = "tcp"
+    security_groups = [aws_security_group.alb.id]
+  }
+
+  ingress {
+    from_port       = 3001
+    to_port         = 3001
+    protocol        = "tcp"
+    security_groups = [aws_security_group.alb.id]
+  }
+
+  ingress {
+    from_port       = 4173
+    to_port         = 4173
+    protocol        = "tcp"
+    security_groups = [aws_security_group.alb.id]
+  }
+
+  ingress {
+    from_port       = 5312
+    to_port         = 5312
+    protocol        = "tcp"
+    security_groups = [aws_security_group.alb.id]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = local.common_tags
+}
+
+resource "aws_launch_template" "ecs" {
+  name_prefix   = "\${local.app_slug}-ecs-"
+  image_id      = data.aws_ssm_parameter.ecs_optimized_ami.value
+  instance_type = var.ecs_instance_type
+
+  iam_instance_profile {
+    arn = aws_iam_instance_profile.ecs.arn
+  }
+
+  network_interfaces {
+    associate_public_ip_address = true
+    security_groups             = [aws_security_group.ecs_host.id]
+  }
+
+  user_data = base64encode(<<-EOF
+    #!/bin/bash
+    echo ECS_CLUSTER=\${aws_ecs_cluster.main.name} >> /etc/ecs/ecs.config
+  EOF
+  )
+
+  tag_specifications {
+    resource_type = "instance"
+
+    tags = merge(local.common_tags, {
+      Name = "\${local.app_slug}-ecs-instance"
+    })
+  }
+
+  tags = local.common_tags
+}
+
+resource "aws_autoscaling_group" "ecs" {
+  name                = "\${local.app_slug}-ecs-asg"
+  vpc_zone_identifier = [aws_subnet.public_a.id]
+  desired_capacity    = var.desired_capacity
+  min_size            = 1
+  max_size            = 1
+  health_check_type   = "EC2"
+
+  launch_template {
+    id      = aws_launch_template.ecs.id
+    version = "$Latest"
+  }
+
+  tag {
+    key                 = "Name"
+    value               = "\${local.app_slug}-ecs-instance"
+    propagate_at_launch = true
+  }
+
+  tag {
+    key                 = "Project"
+    value               = var.project_name
+    propagate_at_launch = true
+  }
+}
+`.trimStart();
+}
+export function renderEcsTf(manifest) {
+    const webEnv = [
+        { name: "API_URL", value: "${var.api_origin}" },
+        ...renderUserEnvVars(manifest.env.web),
+    ];
+    const apiEnv = [
+        { name: "AUTH_SERVER_URL", value: "http://127.0.0.1:5312" },
+        { name: "APP_ORIGINS", value: "${var.api_origin}" },
+        { name: "UI_ORIGINS", value: "${var.web_origin},${var.admin_origin}" },
+        { name: "COOKIE_SIGNING_KEY", value: "${var.cookie_signing_key}" },
+        { name: "API_SERVICE_TOKEN", value: "${var.api_service_token}" },
+        { name: "JWKS_KID", value: "${var.jwks_active_kid}" },
+        { name: "DB_HOST", value: "127.0.0.1" },
+        { name: "DB_PORT", value: "5432" },
+        { name: "DB_USER", value: "${var.api_db_user}" },
+        { name: "DB_PASSWORD", value: "${var.api_db_password}" },
+        { name: "DB_NAME", value: "${var.api_db_name}" },
+        { name: "SQL_LOGGING", value: "false" },
+        ...renderUserEnvVars(manifest.env.api),
+    ];
+    const authEnv = [
+        { name: "NODE_ENV", value: "production" },
+        { name: "APP_NAME", value: "${var.project_name}" },
+        { name: "APP_ID", value: "${local.app_slug}-dev" },
+        { name: "APP_ORIGINS", value: "${var.api_origin}" },
+        { name: "ISSUER", value: "${var.auth_issuer}" },
+        { name: "AUTH_MODE", value: "server" },
+        { name: "DEMO", value: "false" },
+        { name: "DEFAULT_ROLES", value: "user,betaUser" },
+        { name: "AVAILABLE_ROLES", value: "user,admin,betaUser,team" },
+        { name: "DB_LOGGING", value: "false" },
+        { name: "DB_HOST", value: "127.0.0.1" },
+        { name: "DB_PORT", value: "5432" },
+        { name: "DB_NAME", value: "${var.auth_db_name}" },
+        { name: "DB_USER", value: "${var.auth_db_user}" },
+        { name: "DB_PASSWORD", value: "${var.auth_db_password}" },
+        { name: "ACCESS_TOKEN_TTL", value: "30m" },
+        { name: "REFRESH_TOKEN_TTL", value: "1h" },
+        { name: "RATE_LIMIT", value: "100" },
+        { name: "DELAY_AFTER", value: "50" },
+        { name: "API_SERVICE_TOKEN", value: "${var.api_service_token}" },
+        { name: "JWKS_ACTIVE_KID", value: "${var.jwks_active_kid}" },
+        {
+            name: "SEAMLESS_JWKS_ACTIVE_KID",
+            value: "${var.seamless_jwks_active_kid}",
+        },
+        {
+            name: "SEAMLESS_JWKS_KEY_main_PRIVATE",
+            value: "${var.jwks_private_key}",
+        },
+        { name: "JWKS_PUBLIC_KEYS", value: "${var.jwks_public_keys}" },
+        { name: "RPID", value: "${var.rpid}" },
+        { name: "ORIGINS", value: "${var.web_origin},${var.admin_origin}" },
+        { name: "SEAMLESS_BOOTSTRAP_ENABLED", value: "true" },
+        { name: "SEAMLESS_BOOTSTRAP_SECRET", value: "${var.bootstrap_secret}" },
+        ...renderUserEnvVars(manifest.env.auth),
+    ];
+    const adminEnv = [
+        { name: "API_URL", value: "${var.api_origin}" },
+        { name: "AUTH_MODE", value: "server" },
+        ...renderUserEnvVars(manifest.env.admin),
+    ];
+    return `
+resource "aws_ecs_cluster" "main" {
+  name = "\${local.app_slug}-cluster"
+  tags = local.common_tags
+}
+
+resource "aws_ecs_task_definition" "app" {
+  family                   = "\${local.app_slug}-app"
+  network_mode             = "bridge"
+  requires_compatibilities = ["EC2"]
+  cpu                      = "1024"
+  memory                   = "3584"
+  execution_role_arn       = aws_iam_role.ecs_task_execution.arn
+  task_role_arn            = aws_iam_role.ecs_task_role.arn
+
+  container_definitions = jsonencode([
+    {
+      name      = "web"
+      image     = var.web_image
+      essential = true
+      memoryReservation = 128
+      environment = [
+        ${renderEnvEntries(webEnv)}
+      ]
+      portMappings = [
+        {
+          containerPort = 80
+          hostPort      = 0
+          protocol      = "tcp"
+        }
+      ]
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = aws_cloudwatch_log_group.web.name
+          awslogs-region        = var.aws_region
+          awslogs-stream-prefix = "web"
+        }
+      }
+    },
+    {
+      name      = "api"
+      image     = var.api_image
+      essential = true
+      memoryReservation = 512
+      environment = [
+        ${renderEnvEntries(apiEnv)}
+      ]
+      portMappings = [
+        {
+          containerPort = 3000
+          hostPort      = 0
+          protocol      = "tcp"
+        }
+      ]
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = aws_cloudwatch_log_group.api.name
+          awslogs-region        = var.aws_region
+          awslogs-stream-prefix = "api"
+        }
+      }
+    },
+    {
+      name      = "auth"
+      image     = var.auth_image
+      essential = true
+      memoryReservation = 512
+      environment = [
+        ${renderEnvEntries(authEnv)}
+      ]
+      portMappings = [
+        {
+          containerPort = 5312
+          hostPort      = 0
+          protocol      = "tcp"
+        }
+      ]
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = aws_cloudwatch_log_group.auth.name
+          awslogs-region        = var.aws_region
+          awslogs-stream-prefix = "auth"
+        }
+      }
+    },
+    {
+      name      = "admin"
+      image     = var.admin_image
+      essential = true
+      memoryReservation = 128
+      environment = [
+        ${renderEnvEntries(adminEnv)}
+      ]
+      portMappings = [
+        {
+          containerPort = 80
+          hostPort      = 0
+          protocol      = "tcp"
+        }
+      ]
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = aws_cloudwatch_log_group.admin.name
+          awslogs-region        = var.aws_region
+          awslogs-stream-prefix = "admin"
+        }
+      }
+    },
+    {
+      name      = "postgres"
+      image     = var.postgres_image
+      essential = true
+      memoryReservation = 1024
+      environment = [
+        { name = "POSTGRES_USER", value = "postgres" },
+        { name = "POSTGRES_PASSWORD", value = "postgres-dev-root-password" }
+      ]
+      portMappings = [
+        {
+          containerPort = 5432
+          hostPort      = 5432
+          protocol      = "tcp"
+        }
+      ]
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = aws_cloudwatch_log_group.postgres.name
+          awslogs-region        = var.aws_region
+          awslogs-stream-prefix = "postgres"
+        }
+      }
+      mountPoints = [
+        {
+          sourceVolume  = "postgres_data"
+          containerPath = "/var/lib/postgresql/data"
+          readOnly      = false
+        }
+      ]
+    }
+  ])
+
+  volume {
+    name = "postgres_data"
+  }
+
+  tags = local.common_tags
+}
+
+resource "aws_ecs_service" "app" {
+  name            = "\${local.app_slug}-service"
+  cluster         = aws_ecs_cluster.main.id
+  task_definition = aws_ecs_task_definition.app.arn
+  desired_count   = 1
+  launch_type     = "EC2"
+
+  load_balancer {
+    target_group_arn = aws_lb_target_group.web.arn
+    container_name   = "web"
+    container_port   = 80
+  }
+
+  load_balancer {
+    target_group_arn = aws_lb_target_group.api.arn
+    container_name   = "api"
+    container_port   = 3000
+  }
+
+  load_balancer {
+    target_group_arn = aws_lb_target_group.auth.arn
+    container_name   = "auth"
+    container_port   = 5312
+  }
+
+  load_balancer {
+    target_group_arn = aws_lb_target_group.admin.arn
+    container_name   = "admin"
+    container_port   = 80
+  }
+
+  depends_on = [
+    aws_lb_listener.https,
+    aws_autoscaling_group.ecs
+  ]
+}
+`.trimStart();
+}
+export function renderBackupTf() {
+    return `
+locals {
+  backup_schedule_expression = (
+    var.backup_enabled == false ? null :
+    "cron(0 5 * * ? *)"
+  )
+
+  backup_command = "export PGPASSWORD=postgres-dev-root-password && mkdir -p /tmp/backups && pg_dump -h 127.0.0.1 -U postgres -d postgres | gzip > /tmp/backups/backup.sql.gz && apt-get update >/dev/null 2>&1 && apt-get install -y awscli >/dev/null 2>&1 && aws s3 cp /tmp/backups/backup.sql.gz s3://\${aws_s3_bucket.backups.bucket}/postgres/dev/backup-$(date +%Y%m%d%H%M%S).sql.gz"
+}
+
+resource "aws_ecs_task_definition" "backup" {
+  count                    = var.backup_enabled ? 1 : 0
+  family                   = "\${local.app_slug}-backup"
+  network_mode             = "bridge"
+  requires_compatibilities = ["EC2"]
+  cpu                      = "128"
+  memory                   = "256"
+  execution_role_arn       = aws_iam_role.ecs_task_execution.arn
+  task_role_arn            = aws_iam_role.ecs_task_role.arn
+
+  container_definitions = jsonencode([
+    {
+      name       = "backup"
+      image      = "postgres:16"
+      essential  = true
+      entryPoint = ["/bin/sh", "-lc"]
+      command    = [local.backup_command]
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = aws_cloudwatch_log_group.backup.name
+          awslogs-region        = var.aws_region
+          awslogs-stream-prefix = "backup"
+        }
+      }
+    }
+  ])
+
+  tags = local.common_tags
+}
+
+resource "aws_cloudwatch_event_rule" "backup" {
+  count               = var.backup_enabled ? 1 : 0
+  name                = "\${local.app_slug}-backup-schedule"
+  schedule_expression = local.backup_schedule_expression
+}
+
+resource "aws_iam_role" "events_invoke_ecs" {
+  count = var.backup_enabled ? 1 : 0
+  name  = "\${local.app_slug}-events-invoke-ecs-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [{
+      Effect = "Allow",
+      Principal = { Service = "events.amazonaws.com" },
+      Action = "sts:AssumeRole"
+    }]
+  })
+
+  tags = local.common_tags
+}
+
+resource "aws_iam_role_policy" "events_invoke_ecs" {
+  count = var.backup_enabled ? 1 : 0
+  name  = "\${local.app_slug}-events-invoke-ecs-policy"
+  role  = aws_iam_role.events_invoke_ecs[0].id
+
+  policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect = "Allow",
+        Action = ["ecs:RunTask"],
+        Resource = [aws_ecs_task_definition.backup[0].arn]
+      },
+      {
+        Effect = "Allow",
+        Action = ["iam:PassRole"],
+        Resource = [
+          aws_iam_role.ecs_task_execution.arn,
+          aws_iam_role.ecs_task_role.arn
+        ]
+      }
+    ]
+  })
+}
+
+resource "aws_cloudwatch_event_target" "backup" {
+  count    = var.backup_enabled ? 1 : 0
+  rule     = aws_cloudwatch_event_rule.backup[0].name
+  arn      = aws_ecs_cluster.main.arn
+  role_arn = aws_iam_role.events_invoke_ecs[0].arn
+
+  ecs_target {
+    launch_type         = "EC2"
+    task_definition_arn = aws_ecs_task_definition.backup[0].arn
+    task_count          = 1
+  }
+}
+`.trimStart();
+}
+export function renderOutputsTf() {
+    return `
+output "web_url" {
+  value = "https://\${var.web_host}"
+}
+
+output "api_url" {
+  value = "https://\${var.api_host}"
+}
+
+output "auth_url" {
+  value = "https://\${var.auth_host}"
+}
+
+output "admin_url" {
+  value = "https://\${var.admin_host}"
+}
+
+output "backup_bucket_name" {
+  value = aws_s3_bucket.backups.bucket
+}
+`.trimStart();
+}
+export function renderPostgresInitSql(manifest) {
+    const authUser = manifest.runtime.secrets.authDbUser.replace(/'/g, "''");
+    const authPassword = manifest.runtime.secrets.authDbPassword.replace(/'/g, "''");
+    const authDbName = manifest.runtime.secrets.authDbName.replace(/'/g, "''");
+    const apiUser = manifest.runtime.secrets.apiDbUser.replace(/'/g, "''");
+    const apiPassword = manifest.runtime.secrets.apiDbPassword.replace(/'/g, "''");
+    const apiDbName = manifest.runtime.secrets.apiDbName.replace(/'/g, "''");
+    return `
+DO
+$$
+BEGIN
+   IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '${authUser}') THEN
+      CREATE ROLE ${authUser} LOGIN PASSWORD '${authPassword}';
+   END IF;
+END
+$$;
+
+DO
+$$
+BEGIN
+   IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '${apiUser}') THEN
+      CREATE ROLE ${apiUser} LOGIN PASSWORD '${apiPassword}';
+   END IF;
+END
+$$;
+
+CREATE DATABASE ${authDbName} OWNER ${authUser};
+CREATE DATABASE ${apiDbName} OWNER ${apiUser};
+
+GRANT ALL PRIVILEGES ON DATABASE ${authDbName} TO ${authUser};
+GRANT ALL PRIVILEGES ON DATABASE ${apiDbName} TO ${apiUser};
+`.trimStart();
+}
+export function renderPostgresDockerfile() {
+    return `
+FROM postgres:16
+COPY init.sql /docker-entrypoint-initdb.d/001-init.sql
+`.trimStart();
+}
+//# sourceMappingURL=template.js.map